5610 matches found
CVE-2025-55182-RCE-Exploit
POC for CVE-2025-55182 – Next.js 16.0.6 Remote Code Execution This repository contains a working proof-of-concept POC for CVE-2025-55182 , a critical deserialization vulnerability affecting Next.js 16.0.6. The exploit abuses $@ chunk deserialization and Chunk.prototype.then to gain full control...
CVE-2025-53770
CVE-2025-53770 SharePoint Descripción La deserialización de datos no confiables en Microsoft SharePoint Server local permite que un atacante ejecute código de forma remota y comprometa el sistema. Microsoft está al tanto de la explotación activa y está preparando una actualización integral...
Security Bulletin:IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
Summary WmServiceMock is bundled with IBM webMethods Integration Server. Remediation steps are provided below CVE-2026-12118 Vulnerability Details CVEID:CVE-2026-12118 DESCRIPTION: IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary...
Laminas Project laminas-http - Remote Code Execution
Laminas Project laminas-http 2.14.2 and Zend Framework 3.0.0 contain a deserialization vulnerability caused by destruct method in Zend\Http\Response\Stream, letting attackers control content lead to remote code execution, exploit requires attacker-controlled serialized data. id: CVE-2021-3007...
Spring Data Commons - Remote Code Execution
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user or attacker can supply specially crafted request parameters...
Better Search Replace < 1.4.5 - PHP Object Injection
The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...
CVE-2026-27172
camel-consul ConsulRegistry Deserialization Vulnerability Reproducer CVE-2026-27172 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-consul component ConsulRegistry, tracked as CVE-2026-27172. It is the same class of issue as CVE-2024-22369 , CVE-2024-23114 a...
ElasticSearch - Remote Code Execution
ElasticSearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script to the Groovy scripting engine. id: CVE-2015-1427 info: name: ElasticSearch - Remote Code Execution author: pikpikcu...
CVE-2026-55220 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...
CVE-2026-56158-.NET-Framework-RCE-PoC-Exploit
CVE-2026-56158 — Exploit PoC di Esecuzione Remota di Codice RCE in .NET Framework Critico CVSS 9.8 — Deserializzazione di dati non attendibili CWE-502 in Microsoft .NET Framework e .NET Runtime Corretto: 14 luglio 2026 | Attribuito a: Positive Technologies PT-2026-60174 Indice Panoramica Dettagli...
CVE-2021-30128-EXP
CVE-2021-30128 EXP da vulnerabilidade de desserialização do Apache OFBiz Referência https://mp.weixin.qq.com/s/Dr-jwiRr4NByjErjiXe1w...
Lab-for-cve-2018-15133
Riepilogo: MExploiting CVE-2018-15133 Vulnerabilità di deserializzazione Questo exploit sfrutta una vulnerabilità di deserializzazione nel framework Laravel fino alla versione 5.5.40 e nelle versioni 5.6.x fino alla 5.6.29. Descrizione L'esecuzione di codice remoto potrebbe verificarsi a seguito ...
CVE-2025-54897-LAB
Lab: CVE-2025-54897 - Vulnerabilità di deserializzazione in Microsoft Office SharePoint 🚀 Panoramica Questo lab dimostra una vulnerabilità di deserializzazione in Microsoft Office SharePoint che consente l'esecuzione remota di codice RCE. Il problema deriva dalla gestione impropria di dati...
REACT-CVE-2025-55182-Lab
React-2025 CTF Lab: CVE-2025-55182 Übersicht Dieses Repository enthält eine Capture-the-Flag-Laborumgebung CTF, die ausschließlich für Bildungszwecke und Sicherheitsforschung entwickelt wurde. Die Umgebung enthält einen angreifbaren Next.js-16-E-Commerce-Mock-Storefront „Quantum Supplies“, der...
Java-Deserialization-Scanner
Java Deserialization Scanner Java Deserialization Scanner ist ein Burp-Suite-Plugin, das darauf abzielt, Java-Deserialisierungsschwachstellen zu erkennen und auszunutzen. Es wurde von Federico Dotta, Principal Security Analyst bei HN Security, geschrieben. Das Plugin besteht aus drei verschiedene...
Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
Ajax.NET Professional AjaxPro contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users are advised to discontinue use and/or transition to a...
Astra Linux – Vulnerability in Jackson-Databind
In FasterXML Jackson-Databind before version 2.13.4, resource exhaustion can occur due to the lack of a check in BeanDeserializer.deserializeFromArray, which prevents the use of deeply nested arrays. An application becomes vulnerable only with certain customized choices for deserialization...
Microsoft Entra ID Deserialization of Untrusted Data Vulnerability
Microsoft Entra ID formerly known as Azure Active Directory contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network...
Deserialization of Untrusted Data
Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the setBeanClassLoader process. An attacker can execute arbitrary code by injecting malicious serialized data into the INTMESSAGE.MESSAGECONTENT field. This is only exploitable if the deserializatio...
